SigmaHQ Detections
@sigmaHQ12 followers122,432 downloads2,527 copies16 likes159,730 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when 'verclsid.exe', a legitimate Windows binary, is used to execute a COM object via its GUID. This technique is often leveraged by adversaries for defense evasion and to bypass application control mechanisms by proxying execution through a trusted system binary.
Detects attempts to tamper with autologger trace sessions by modifying specific registry values. This technique is often used by attackers to disable or impair logging, particularly for Windows Event Log and Windows Defender related logs, to evade detection.
Detects modifications to the "PendingFileRenameOperations" registry key when initiated by suspicious or uncommon executable locations or by specific system utilities like `reg.exe` or `regedit.exe`. This registry key is used by Windows to stage files for renaming or deletion after a system reboot, and its manipulation can be a defense evasion technique to replace legitimate files with malicious ones or to remove forensic artifacts.
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Detects the execution of common reconnaissance commands (ipconfig, net, netstat, ping, systeminfo, tasklist, whoami) where the output is piped to `findstr.exe`. This technique is often used by attackers during the reconnaissance phase to extract specific information.
Detects the deletion of a registry key responsible for the 'Scan with Defender' option in the Windows context menu. Attackers may delete this key to hinder users from easily scanning suspicious files, thereby weakening defenses.
Detects the creation of named pipes by alternate PowerShell hosts, which might be used to bypass detections specifically looking for `powershell.exe`. This rule identifies processes that create named pipes starting with '\PSHost' but are not the standard PowerShell executables or other common legitimate processes that might use such pipes.
Detects suspicious copy operations where a program is copied from a system directory (System32, SysWOW64, WinSxS) to another location on disk. This technique is often used by adversaries to move Living Off The Land Binaries (LOLBINs) like 'certutil' or 'desktopimgdownldr' to a different directory or rename them to bypass detections based on their original location or name.
Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows. This registry modification can be used by adversaries for defense evasion, potentially to suppress pop-ups that might alert a user to unusual browser behavior or to streamline the execution of malicious activities without user interaction.
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
Page 273 of 680